Report reveals how this hacking group went from crypto attacks to targeting defence sector
The report shows how Lazarus’ DeathNote cluster has moved beyond crypto attacks to focus on the defence sector with upgraded capabilities.
Expand
The actor also switched all decoy documents related to job descriptions from defence contractors and diplomatic-related ones. In May 2021, an IT company in Europe was compromised, and in early June 2021, the Lazarus subgroup began using a new mechanism to infect targets in South Korea.
The DeathNote cluster has evolved significantly since its discovery in 2015, with new modules and capabilities added over time. The malware is highly effective in evading detection by antivirus software due to its ability to customise payloads based on specific objectives and targets. Kaspersky recommends maintaining vigilance and taking proactive measures to defend against the Lazarus group’s malicious activities.
To avoid targeted attacks, conduct cybersecurity audits, train employees in basic cybersecurity hygiene, download software only from trusted sources, use EDR for timely incident detection and response, and adopt anti-fraud solutions to protect cryptocurrency transactions. Kaspersky Managed Detection and Response offer threat-hunting capabilities against targeted attacks.
